On Tue, 2005-11-22 at 23:57 -0500, Valdis.Kletnieks@vt.edu wrote:
Keep in mind that 98% of systems are nailed by either automated worms or
people running canned stuff. Just because it's not "real hacking" doesn't
mean it doesn't actually work in practice.
Quite right, the majority of security incidents dealt with by
administrators (the guys that have a use for these courses) are the
automated/canned/known attacks, so for people in that position an
understanding of these attacks is extremely important for their own
network defense. These courses usually market themselves to the guy
looking to understand how systems are compromised. They are most useful
for pen-testers that rely on vulnerability scanners and the sysadmin
looking after his network.
For the guys writing the exploit code and figuring out to work around
things like ProPolice and DEP these courses won't help - no matter how
in depth they are, because figuring these sort of details out doesn't
require any knowledge you can be taught in a classroom, it requires
dedication and in most cases addiction to the task.
There definitely is a market and a value in these courses as they raise
the general security awareness of network administrators. A common
question among guys working in these sort of roles is "How do I get to
do that cool security stuff", the sad thing is the fact that they don't
already know the answer means they probably will never be any good, as
the most important part of it is ingenuity and initiative as well as the
dedication/addiction mentioned above.
The common mantra used within this sort of training is "think like an
attacker". My opinion is if you have to be taught that, you can never
think like an attacker, because the attacker doesn't have to focus his
thoughts he is always, automatically, looking for a way
around/over/under/through. The guy trying to think like an attacker is
focusing on his adversary when the real focus should be his systems,
because that's where the attackers focus is.
--
With Regards..
Barrie Dempster (zeedo) - Fortiter et Strenue
"He who hingeth aboot, geteth hee-haw" Victor - Still Game
blog: http://reboot-robot.net
sites: http://www.bsrf.org.uk - http://www.security-forums.com
ca: https://www.cacert.org/index.php?id=3
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
